Attackers are targeting browser notification features as web browsers boost protections.
WatchGuard Technologies, a global leader in unified cybersecurity, has released the findings of its latest Internet Security Report, detailing the top malware trends and network and endpoint security threats analyzed by WatchGuard Threat Lab researchers in Q1 2023.
Key findings from the data show phishers leveraging browser-based social engineering strategies, new malware with ties to nation states, high amounts of zero-day malware and a rise in living-off-the-land attacks.
“Organizations need to pay more active, ongoing attention to the existing security solutions and strategies their businesses rely on to stay protected against increasingly sophisticated threats,” said Corey Nachreiner, Chief Security Officer, WatchGuard.
Key findings from the report are:
- New browser-based social engineering trends
Now that web browsers have more protections preventing pop-up abuse, attackers have pivoted to using the browser notifications features to force similar types of interactions. Also of note from this quarter’s top malicious domains list is a new destination involving SEO-poisoning activity.
- Threat actors from China and Russia behind 75% of new threats in the Q1 Top 10 list
Three of the four new threats that debuted on our top ten malware list this quarter have strong ties to nation states, although this doesn’t necessarily mean those malicious actors are state-sponsored.
- Persistence of attacks against Office products, End-of-Life (EOL) Microsoft ISA Firewall
Threat Lab analysts continue to see document-based threats targeting Office products in the most widespread malware list this quarter. On the network side, the team also noticed exploits against Microsoft’s now-discontinued firewall, the Internet Security and Acceleration (ISA) Server, getting a relatively high number of hits. Considering this product has long been discontinued and without updates the analysts admit surprise to see attackers targeting it.
- Living-off-the-land attacks on the rise
The ViperSoftX malware reviewed in the Q1 DNS analysis is the latest example of malware leveraging the built-in tools that come with operating systems to complete their objectives. The continued appearance of Microsoft Office and PowerShell-based malware in these reports quarter after quarter underscores the importance of endpoint protection that can differentiate legitimate and malicious use of popular tools like PowerShell.
- Malware droppers targeting Linux-based systems
One of the new top malware detections by volume in Q1 was a malware dropper aimed at Linux-based systems.
- Zero day malware accounting for the majority of detections
This quarter saw 70% of detections coming from zero day malware over unencrypted web traffic and a whopping 93% of detections from zero day malware from encrypted web traffic.
- New insights based on ransomware tracking data
In Q1 2023, the Threat Lab tallied 852 victims published to extortion sites and discovered 51 new ransomware variants. These ransomware groups continue to publish victims at an alarmingly high rate; some are well-known organizations and companies in the Fortune 500.
